Access Control

SSoT for authority in the deployed contract set: principals, what each may do, and how long each action takes to become executable. Residual power is fail-closed: a hostile guardian can stop the protocol indefinitely while never moving value or widening a bound. Per-role detail lives in the children: Deployer, Admin, Risk Steward, Guardian, Oracle Keeper, Treasury. Live addresses: Contract Addresses.

1. Principals

Not OpenZeppelin role bitmasks, and there is no PAUSER_ROLE. Owner sets whitelists via setGuardian / setKeeper; the steward grant is queueRole(RISK_STEWARD) → executeRole at the LISTING delay, revoke is instant revokeRiskSteward.

One governance principal. Pool deployment is permissionless (PoolFactory.createPool); pool administration always resolves to AccessControl.owner(), no per-pool curator. AccessControl.Role is exactly NONE (0), FACTORY (1), TREASURY (2), OWNER (3), RISK_STEWARD (4), GUARDIAN (5), GUARDIAN_REVOKE (6). The treasury is a pointer the owner rotates, not a principal (Treasury).

Ownership handover and the transferOwnership / renounceOwnership reverts: Admin.

1.1. Arming the quorum policy

AccessControl.armQuorumPolicy(guardians) is a one-way latch: callable once, by the owner, never unset. It refuses to arm unless every condition below already holds, so arming asserts a production-shaped deployment rather than making one.

After arming, setGuardian(g, false) reverts ThresholdViolation once it would drop guardianCount to zero, and every newly granted guardian must pass the quorum check.

quorumStatus() is the monitoring view: a multisig that lowers its own threshold post-arm is invisible to every on-chain gate but visible there.

2. Halt authority

Halt is immediate (no timelock). Release is owner-only.

One asset-level lever, not two. haltAsset(pool, token, src) sets one or more source bits in PoolConstantsLib.HALT_MASK (HALT_RISK_BIT = bit 0, HALT_GUARDIAN_BIT = bit 6); unhaltAsset(pool, token, src) clears only the bits passed, so lifting a fleet-wide guardian halt cannot relist a leg an owner risk halt still holds down. Authority is by edge, not by source: halting is guardian-or-owner for every src, un-halting is owner-only for every src. The other levers above act on a feed or an upgrade request, not on an asset.

A queued timelock (MIGRATE_BASE_TOKEN / setBaseToken included) is not a pause.

Depeg is one trigger among many; its detection and auto-halt path is Flow Guards.

2.1. Escalation

Confirm wallet chain before send: pool salt includes block.chainid (PoolFactory.sol).

2.2. Fleet sweep

2.3. Contact

security@btr.markets (reasonable-best-efforts). Status / Discord channels announced pre-mainnet.

3. Timelock parameters

Timelock durations SSoT. The whole fleet’s schedule is one deploy-time word: up to 8 tiers x uint32 seconds, indexed by ConstantsLib.Tier (3 members), passed to the AccessControl constructor and exposed as the immutable AccessControl.GOV_DELAYS(). Every governed contract (Admin, PoolFactory, Flash, OracleBeacon, ExternalOracle) derives its own tier delays from that word at construction via Constants.delayOf(schedule, tier). No setter, no proxy: the word cannot change after construction, owner included. Nothing branches on block.chainid.

Production passes Constants.PROD_DELAYS, the schedule below. No zero-delay schedule exists: the deploy path rejects any schedule whose smallest tier delay is below Constants.MIN_ARMED_DELAY (1 h), and Constants.sol marks ZERO_DELAYS as not deployable. Public testnets pass Constants.TESTNET_DELAYS.

Tiers split by what an op changes: structure (code, who governs, protocol money, re-rooting) waits a week, listing and pricing waits a day, bounded numbers wait an hour. TUNING does not scale with the deployment: one hour is MIN_ARMED_DELAY, the floor the timelock arms at. Risk parameters are bounded by PoolConfig constants at execute, so the delay is a public review window and not the safety property. De-risking stays instant on every tier: halt, tighten, cancel, unhalt and unpause live outside the schedule.

4. Owner-gated op classes

Every pool op queues through one generic entrypoint, requestOp(pool, uint8 opType, bytes32 subject, bytes payload), and cancels through one, cancelTimelock(pool, opType, subject). opType is the IPool.OpType enum ordinal, so the declaration order below is load-bearing for any caller encoding a uint8:

enum OpType {
    NONE,                 // 0
    MIGRATE_BASE_TOKEN,   // 1
    UPDATE_ANCHOR,        // 2
    UPDATE_TREASURY,      // 3
    UPDATE_HOOK,          // 4
    ADD_ASSET,            // 5
    UPDATE_RISK,          // 6
    UPDATE_FEES,          // 7
    UPDATE_PROFILE,       // 8
    UPDATE_CURVE,         // 9
    UPDATE_ASSET_PARAMS,  // 10
    SWEEP,                // 11
    BACKFILL_LEGS,        // 12
    UPDATE_POOL_ADMIN     // 13
}

requestOp selects the tier from one exhaustive table and reverts InvalidInput on any value that table does not name; there is no default arm that would hand an unknown op the shortest delay. Execute is one named function per op. Entry points on Admin unless noted.

There is no oracle repoint op. Each pool reads one immutable oracle proxy address; the implementation behind it moves through OracleBeacon.requestUpgrade → LISTING → executeUpgrade, guardian-cancellable.

Three owner levers in the Immediate row bypass Admin and its timelock entirely. None is a pool-param write:

• Pool.adminSetDeadSeedPow10(token, pow10) is gated directly on AccessControl.owner(), not on the Admin singleton. It sets the dead-seed exponent used to price the first depositor’s index pin, is bounded at decimals + 3, and takes effect only while the leg is still unseeded.
• PoolFactory.deregisterPool(pool) evicts a pool from every discovery index. Pool deployment is permissionless, so this is the de-pollution lever for griefing clones; it does not touch the pool’s funds or its ability to trade.
• PoolFactory.setProtocolDeployer(newDeployer) changes which address mints pools that count as official. Untimelocked, so a compromised owner key can point “official” at itself for as long as it holds the key.

UPDATE_ASSET_PARAMS (ordinal 10) is deliberately absent from that table and cannot be passed to requestOp; the call reverts.

Whether a params write queues or applies instantly is the defensive-tighten policy, decided inside setAssetParams, the only entrypoint that may queue one. It writes immediately before bootstrapSealed[pool] or on a defensive tighten, and otherwise queues itself at TUNING for executeSetAssetParams.

Any minLiquidity change queues in either direction. A raise halts outflow instantly while its reversal would wait out the TUNING delay (1 hour under PROD_DELAYS), and haltAsset already covers that need on both edges.

RiskConfig follows the same asymmetry: setRiskConfigTighten and raiseKappa land now, every other direction is a queued UPDATE_RISK (Admin §5.3).

5. Upgrade sequence

1. Queue: PoolFactory.requestReferenceUpgrade, or requestUpgrade on Admin / Flash
2. Wait the GOVERNANCE tier delay (7 d under PROD_DELAYS)
3. Execute inside GRACE_PERIOD or request expires
4. Cancel anytime before execute (cancelReferenceUpgrade / cancelUpgrade): owner or guardian

Beacon swap re-points every live pool. Procedure: Admin.

6. Oracle push roles

Signers are a granted set on the oracle and authorize by signature. The relayer that lands the batch is unpermissioned on the signed path (pushSignedV4); V4’s session path (pushV4) pins msg.sender to the single relay named in a quorum-signed SessionGrant, capped at one hour and revocable by any one signer. Either way the relay holds no price authority. Quorum loosening is timelocked at LISTING, tightening and revocation are immediate. Full ceremony and constants: Oracle Keeper.

7. Related